Salesforce Winter '27 Is Live: What Can Break in Your Org and How to Fix It

Salesforce Winter '27 enforces five release updates as soon as your org upgrades, and two more land on calendar dates before Christmas: 30 November and 1 December 2026. The OAuth username-password flow retirement has slipped to 20 February 2027. Australian-hosted and Asia-Pacific instances upgrade in the final window, on Saturday 10 October UTC. Start in Setup under Release Updates.

When does Winter '27 reach your org?

Per the Winter '27 release notes, Salesforce first published them in the week of 17 August 2026. Dates below are from the official sandbox preview instructions and Salesforce Trust maintenance data, queried 8 September 2026.

Milestone	UTC	New Zealand time
Sandbox preview cutoff	01:00, 28 August (6:00 PM PT, 27 August)	13:00 NZST, Friday 28 August
Preview sandboxes upgraded	28 and 29 August	Sat 29 Aug 13:00 to Sun 30 Aug 07:00 NZST
Production window 1	Sat 3 October, 00:30 to 07:30	Sat 3 Oct 13:30 to 20:30 NZDT
Production window 2 (largest)	Fri 9 October 18:00 to Sun 11 October 06:00	Sat 10 Oct 07:00 to Sun 11 Oct 19:00 NZDT
Every AUS and AP instance	Sat 10 October, 15:00 to 19:30	Sun 11 Oct 04:00 to 08:30 NZDT

Sandboxes not on preview upgrade on 9 and 10 October. Your own instance is listed on Salesforce Trust under its Maintenance tab; check it rather than assume. For New Zealand readers, October times are UTC plus 13 hours once daylight saving starts on 27 September.

What changed since our July post?

Our July dates post predates the release notes and has since been updated. In short: the username-password flow retirement is postponed to 20 February 2027, per the release update page; Adopt Authorized Email Domains is cancelled, per its page, and replaced by Maintain Your Email Verification Exception, enforced 1 December 2026; two accessibility updates postponed from Summer '26 are now enforced; and the Order Management tax-rate item is not on the Winter '27 Release Updates page at all.

Which release updates enforce with Winter '27?

Five updates sit under "Enforced with This Release" on the Winter '27 Release Updates page and take effect when your org upgrades.

Assign Use Any API Auth Permission for SOAP login()

What changes. Per the release note, "Users without the Use Any API Auth user permission can no longer authenticate with SOAP API login() and will encounter an error." Where: all API-enabled editions.

Who it bites. Anything logging in with a username and password over SOAP: older middleware, data-loading tools, cross-org data sources.

How to check. Login History in Setup. Salesforce's retirement article says to look for Login Type "Other Apex API" or "Partner Product", Login Subtype "SOAP API", and API Type "SOAP Enterprise", "SOAP Partner" or "SOAP Tooling".

How to fix. Assign Use Any API Auth to those users by permission set. It is a stopgap: SOAP login() in API versions 31.0 to 64.0 retires in Summer '27, so plan the move to external client apps and OAuth now.

Enable Profile Filtering

What changes. Per the release note: "Profile filtering prevents users from viewing profile names other than their own unless they're assigned the View All Profiles permission." Where: Essentials, Professional, Enterprise, Performance, Unlimited, Developer and Database.com editions.

Who it bites. Anyone whose job needs other people's profile names: team leads running User reports, User list views filtered by profile, screen flows that show a profile name to a non-admin.

How to check. In a sandbox on Winter '27, log in as a standard user, not as yourself, and open every report, list view and flow that touches profile. Admin testing proves nothing here.

How to fix. Grant View All Profiles only to users who need it, via a permission set. Where automation depends on a profile name, move that logic to a permission set or custom permission.

The three accessibility updates at 200%+ zoom

WCAG 2.2 Resize and Reflow changes for Lightning Experience in all editions, with an order. Enable Page Headers and Modal Windows When Zoom Is Greater Than 200% first; the other two depend on it. Then Cards, Docked Containers, Menu Lists, and Panels and Date Pickers, Popovers, Bottom Utility Bars, Record Headers. Two were postponed from Summer '26.

What changes. "The page header scrolls with the page and doesn't block the content." Modal buttons stay in the viewport. Cards and panels stay usable "at 1280px page width and 400% magnification". Bottom utility bars truncate button labels.

Who it bites, and the fix. Low risk: users who work zoomed in. Enable all three in order in a sandbox, zoom past 200 percent, walk your busiest pages, and shorten any utility bar label that loses its meaning.

What enforces before Spring '27, and what comes after?

Everything below is on the Winter '27 Release Updates page or in the Winter '27 API notes, as at September 2026. Calendar dates enforce whatever release you are on; check the Where line on each page for editions.

Release update	Enforces	Who is affected	What to do
OAuth 2.0 device flow restricted to local external client apps	30 November 2026	Device flow on connected apps, or on apps without a localhost callback	Local external client app with a localhost callback URL
Maintain Your Email Verification Exception	1 December 2026	Orgs where Support once disabled email verification	Set Require Address Verification to Send Email on each authorized email domain
OAuth user-agent and hybrid user-agent flows retired	20 February 2027	Apps that hand tokens to the browser	Web-server or hybrid web-server flow with PKCE; packaged apps: ask the developer
OAuth 2.0 username-password flow retired	20 February 2027 (postponed)	All editions; hidden if already blocked	Web-server flow with PKCE for users; client credentials flow for server-to-server
Update Instanced URLs in API Traffic	Spring '27, phased. Per the end-of-support schedule: sandboxes from 22 October 2026, production in waves from 12 January to 25 March 2027 (AP53: 2 to 4 March)	Code or middleware calling an instance host name	Use your My Domain login URL
Salesforce to Salesforce retired	Spring '27	Classic orgs that enabled it before Spring '26	Partner Cloud, Data Cloud One, MuleSoft Anypoint or MuleSoft for Flow
Cross-org adapter legacy authentication retired	Spring '27	Cross-org data sources on password or OAuth 2.0 auth	Named credentials, then Validate and Sync
Changed sharing recalculation behaviour	Spring '27	Only some orgs; Apex or flows expecting instant share records	Review the criteria in step one, then fix
View Setup Audit Trail permission	Spring '27	New profiles and permission sets	Automatic for existing View Setup holders; grant explicitly on new ones
Non-public fields removed from Aura action responses	Spring '27	Lightning components reading internal system fields	Enable in a sandbox; test affected components
Migrate All Connected Apps to External Client Apps	Summer '27	Enterprise, Unlimited, Developer; connected apps keep working, unsupported	App Manager: Migrate to External Client App
Block anonymous Apex from managed packages	Summer '27	Existing managed packages	Check the impact assessment on Apex Settings
SOAP API login() retired in API versions 31.0 to 64.0	Summer '27	Anything still calling SOAP login()	External client apps and OAuth; its test run blocks SOAP login() org-wide
Platform API versions 31.0 to 40.0 (not a release update)	Deprecated Summer '27; retired Summer '28	REST, SOAP or Bulk integrations on those versions	Move to API version 41.0 or later

What else is retiring?

Not release updates, but each has a Winter '27 release note.

• Microsoft Exchange Web Services (EWS). Microsoft retires EWS for Microsoft 365 from October 2026, so Einstein Activity Capture, Inbox and Lightning Sync on EWS stop syncing. Upgrade to Microsoft Graph in Setup.
• Lightning Sync is scheduled to retire in 2027 and Salesforce for Outlook in December 2027; Einstein Activity Capture and the Outlook integration replace both.
• Sales Engagement Performance Dashboard retires in November 2026.
• Work Summaries for Case (Beta) retires on 30 September 2026; move to Enhanced Summaries.
• Experience Builder Agent (Beta) is discontinued as of September 2026.
• Developer Console is hidden by default; re-enable it under Setup, Web Console.

How do you test this safely?

1. Find your date on Salesforce Trust: search your instance, Maintenance tab.
2. Open Setup → Release Updates. Cards you cannot see do not affect your org.
3. Test runs in a sandbox already on Winter '27, never production. Sandboxes refreshed before the 27 August cutoff are upgraded now; others stay on Summer '26 until 9 or 10 October. Salesforce warns the SOAP login() retirement test run "blocks all SOAP API login() calls for the duration of the test".
4. Enable the accessibility updates in order, page headers first.
5. Test as a standard user for Profile Filtering.
6. Inventory your integrations: every connected app, its OAuth flow, its API version. Migration steps are in our integrations post.
7. Check known issues at issues.salesforce.com after your sandbox upgrades.
8. Walk your critical paths: lead to opportunity, cases, integrations, Monday reports. New features are in our admin and Flow post.

How can SAASKOOL help?

If you are the one admin with no developer to hand, this list is a week of evenings. Release readiness is part of SAASKOOL's managed services (from NZ$1,000 a month): Trust window, sandbox test runs, integration inventory and fixes before production upgrades. For a one-off look, start with the free health check; our health check post explains what it covers.

Frequently Asked Questions

When does Salesforce Winter '27 reach Australian-hosted orgs? Per Salesforce Trust data as at 8 September 2026, every Australian-hosted (AUS) and Asia-Pacific (AP) production instance upgrades on Saturday 10 October UTC: between 04:00 and 08:30 on Sunday 11 October 2026 NZDT. Sandboxes not on preview upgrade on 9 or 10 October. Confirm your own instance on Trust under the Maintenance tab rather than assuming.

Which Winter '27 release updates enforce immediately? Five, under Enforced with This Release: Assign Use Any API Auth Permission for SOAP login(), Enable Profile Filtering, and three accessibility enhancements for zoom above 200 percent (page headers and modals; cards and panels; date pickers, utility bars and record headers). Two more enforce on calendar dates: the OAuth device flow restriction on 30 November 2026 and Maintain Your Email Verification Exception on 1 December 2026.

Is the OAuth username-password flow retired in Winter '27? No. Salesforce postponed it from Winter '27 to 20 February 2027, and integrations on that flow stop authenticating then. Salesforce recommends the web-server flow with PKCE for user logins and the client credentials flow for server-to-server integrations. If the update is not visible in your Setup, the flow is already blocked in your org and you are not affected.

What happened to the Adopt Authorized Email Domains release update? It was cancelled and replaced by Maintain Your Email Verification Exception, enforced on 1 December 2026, which only appears in orgs where Salesforce Support once disabled email address verification. Set Require Address Verification to Send Email on each authorized email domain before then, or users with unverified addresses cannot send email from Salesforce. Login is not affected.

How do I test Winter '27 release updates without breaking production? Use a sandbox already on Winter '27, not production. In Setup under Release Updates, enable each update or its test run there, with the accessibility set in dependency order. Test as a standard user, not as an admin. Salesforce warns the SOAP login() retirement test run blocks every SOAP login() call while it runs, so never start it in production with unmigrated integrations.

---

SAASKOOL keeps orgs release-ready as part of managed services: Trust dates, sandbox test runs, integration audits and the fixes, handled. Want to know where your org stands before your upgrade window? The health check is free.